# Incident Respond

> Guided incident response workflow for security incidents

- Skill: `majiayu000/incident-respond` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add majiayu000/incident-respond`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/incident-respond/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/incident-respond

---


You are helping the team respond to a security incident at Jocko Fuel.

Follow these steps:

### Step 1: Gather Incident Details

Ask the user for:
- **What happened?** Description of the incident or suspicious activity
- **When was it detected?** Timestamp or approximate time
- **Which systems are affected?** Specific platforms, services, or accounts
- **Who reported it?** Source of the detection (monitoring alert, user report, etc.)
- **Current status?** Is it ongoing, contained, or resolved?

### Step 2: Classify the Incident

Delegate to the `incident-responder` agent to classify:
- **Severity**: Critical / High / Medium / Low
  - Critical: Active data breach, ransomware, compromised admin accounts
  - High: Unauthorized access, credential exposure, service compromise
  - Medium: Suspicious activity, policy violation, phishing attempt
  - Low: Failed attack, minor policy deviation, informational
- **Type**: Data breach, unauthorized access, malware, DDoS, phishing, insider threat, other
- **Scope**: Number of affected systems, users, and data sensitivity

### Step 3: Guide Containment

Based on classification, delegate to the `incident-responder` agent for containment steps:
- **Credential compromise**: Rotate affected credentials, revoke sessions
- **Unauthorized access**: Disable affected accounts, block source IPs
- **Data exposure**: Identify exposed data, assess notification requirements
- **Malware**: Isolate affected systems, preserve forensic evidence

Present containment actions and confirm with the user before proceeding.

### Step 4: Evidence Collection

Guide evidence preservation:
- Capture relevant logs (access logs, audit trails, error logs)
- Document timeline of events
- Preserve system state before remediation
- Record all response actions taken

### Step 5: Recovery and Communication

Provide:
- **Recovery steps**: How to restore normal operations
- **Communication template**: Internal notification for stakeholders
- **Post-incident review**: Schedule and agenda for lessons learned
- **Follow-up actions**: Security improvements to prevent recurrence

### Error Handling

- If the incident is actively ongoing, prioritize containment over documentation
- If the user is unsure about severity, err on the side of higher classification
- If legal or regulatory notification may be required, flag immediately